Privacy statement — eny Credit

“Personal data” means all information that can be associated with a specific person, and “process” means any handling of it, e.g. collection, use and disclosure. In this privacy statement we explain how we process personal data in connection with our activity as a loan broker. If you would like further information about our data processing, please feel free to contact us.

Who is responsible for processing your data?

For the data processing described in this privacy statement, the following company is the “controller”, i.e. the entity primarily responsible under data protection law (also “we”):

eny Finance AG Baslerstrasse 60, CH-8048 Zürich

For questions on data protection: Tel. 0848 460 000, email eny@enyfinance.ch.

How do we process your personal data?

We process your personal data in order to conclude and carry out a loan and credit card brokerage agreement with you. For this it is necessary that we exchange certain personal data with lenders. Currently these are the following lenders: Bank-now AG, bob Finance AG, Cembra Money Bank AG.

So that lenders can carry out an assessment of ability to repay with a view to a possible loan grant and comply with statutory identification obligations, they depend on personal data that we collect as loan broker. Based on the data collected, we make a pre-selection and, where applicable, forward personal data to lenders. This concerns in particular:

master and contact data (title, name, address, phone numbers, email address) and length of residence at the current address
date of birth, marital status, nationality and correspondence language
details on dependants, e.g. number and year of birth of dependent children
financial data such as the amount of your monthly income and expenses
evidence such as salary statements for the last three months and a copy of an identity document
where applicable, an extract from the debt enforcement register
details on your professional situation, e.g. current and previous employer and length of employment
details on your housing situation
details on the intended use of the loan

For the pre-selection, we may obtain and forward additional address and creditworthiness information from private commercial credit reference agencies such as CRIF, Intrum or comparable agencies. To the extent required for loan brokerage, we may draw further data from public registers (e.g. the commercial register) or the internet. Lenders may request further data if needed.

We receive a commission payment from lenders if a loan is granted. The amount depends on the type of loan agreement. We therefore also process information on the credit decision and the loan agreement: reasons for rejection, offer details (loan volume, interest rate, start and end date, instalment amount), the conclusion of insurance products in connection with the loan, the payout status, and any default or early repayment.

In the event of payment arrears, we are contractually obliged to lenders to provide certain support services in collection, such as determining your residential address.

To the extent required for the payout of the loan, we also forward the data mentioned above to the merchant (“partner”) for whose products or services you wish to use the loan.

How do third parties process your personal data?

Our data exchange with lenders and partners is necessary for loan brokerage. Lenders may themselves obtain further information and, in particular in the context of statutory obligations, disclose personal data to authorities and other third parties. This also includes reports to information offices such as the Central Office for Credit Information (ZEK) and the Information Office for Consumer Credit (IKO). Lenders are independent controllers and, where applicable, inform in their own privacy statements about their data processing.

We also otherwise cooperate with third parties, in particular IT service providers (e.g. hosting, data analysis), dispatch and logistics service providers as well as banks, the post office and consultants. These service providers may also process personal data to the extent necessary.

Can we disclose data abroad?

Recipients of data are not only located in Switzerland, in particular certain IT service providers with locations in the EU/EEA and worldwide. We may also transmit data to authorities and other persons abroad if we are legally obliged to do so or if this is necessary, for example, in the context of a business sale or court proceedings. Not all countries have adequate data protection; we compensate for this with appropriate agreements, in particular the European Commission’s standard contractual clauses. In certain cases we may transmit data even without such agreements, e.g. with your consent or if this is necessary for the performance of the contract or the enforcement of legal claims.

Are there further processing activities?

Yes. Further cases include, among others:

Communication: in the event of contact with us (e.g. a call to customer service) we process details on the content, type, time and place of communication. Phone calls may be recorded and monitored; we inform you at the start of each call.
Compliance with legal requirements: disclosure of data to authorities under statutory obligations.
Prevention: processing to prevent crimes and violations, e.g. fraud prevention.
Legal proceedings: processing in the context of court or administrative proceedings.
IT security: monitoring, protection, backups and archiving of our IT infrastructure.
Transactions: in the event of the sale or acquisition of receivables, business units or companies.
Other purposes: training, administration, statistics and safeguarding legitimate interests.

For how long do we process your personal data?

We process your personal data for as long as necessary for the purpose of processing (for agreements, usually for the duration of the contractual relationship), for as long as a legitimate interest in retention exists, and for as long as a statutory retention obligation applies — for certain data, for example, ten years. We may also be contractually obliged to retain certain data, for example towards lenders for loan applications and decisions. After the periods expire, we delete or anonymise your personal data.

What are your rights?

Within the scope of applicable data protection law, you may:

request further information about our data processing, including a request for access with a copy of your data
object to our data processing
have inaccurate or incomplete personal data corrected, completed or provided with a note of dispute
receive, in a structured, commonly used, machine-readable format, the personal data you have provided to us, to the extent that processing is based on your consent or is necessary for the performance of the contract
revoke a given consent at any time with effect for the future

Please contact us at the contact details given above; as a rule we must verify your identity. You may also lodge a complaint with the competent supervisory authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC).